Privacy Policy

Your privacy matters. This policy explains what data we collect, why, and what you can do about it. We comply with the GDPR (EU Regulation 2016/679) and Spanish LOPDGDD (Organic Law 3/2018).

Data controller

RemoteTalent is a trading name operated by Leopoldo Pérez Ortiz, self-employed (autónomo) with Spanish tax ID 30952536X (intra-EU VAT: ES30952536X) and registered address at Calle Isaac Albéniz 12, 45638 Pepino (Toledo), Spain. Privacy contact: privacy@remotetalent.dev. Data Protection Officer: not applicable (does not meet GDPR art. 37 criteria).

What we collect

• Account: email, name, preferred language. You provide it at sign-up.
• Candidate profile: title, location, story, skills, interests, minimum salary, social links. Only if you fill it in and publish it.
• CV: the content you add to the CV builder; public only if you publish.
• Jobs (companies): job content, company and billing info.
• Applications: which jobs you apply to and their status.
• Payment data: handled by Stripe. We only store the Stripe session ID and the amount charged — we never see or store card numbers.
• Cookies essential for session (Supabase Auth) and preference (language, cookie banner accepted). Full detail on Cookies.
• Aggregated usage data (analytics): page views, device, approximate country. Via PostHog (if enabled) and Vercel Analytics.
• Technical logs: errors and minimal metadata to operate the service.

Why we use it (legal bases)

• Contract performance (GDPR art. 6.1.b): to provide the service (publish profile/CV/jobs, receive applications, process payments).
• Legitimate interest (GDPR art. 6.1.f): to prevent abuse, maintain platform security, and run aggregated analytics to improve the product.
• Consent (GDPR art. 6.1.a): newsletter and product update emails (toggle off any time in Settings).
• Legal obligations (GDPR art. 6.1.c): retention of invoices and fiscal data as required by Spanish law.

Processors

We share data only with providers who process it on our behalf under a Data Processing Agreement (DPA):

• Supabase, Inc. — database, auth and file storage (EU region — Frankfurt, Germany).
• Vercel Inc. — web hosting and edge network; Vercel Analytics and Speed Insights (EU / global). Analytics is cookieless.
• Stripe Payments Europe Ltd. — payment processing (Ireland). We do not store card data.
• Resend Inc. — transactional email delivery (magic links, notifications). EU region (Ireland).
• Cloudflare, Inc. — DNS, DDoS protection and Email Routing (processes incoming emails to @remotetalent.dev addresses).
• PostHog Inc. (optional, only if `NEXT_PUBLIC_POSTHOG_KEY` is configured) — aggregated product analytics. EU region (Frankfurt, Germany).

We have a signed DPA or equivalent clauses with each of them ensuring GDPR compliance.

Retention

We keep your data while your account is active. On account deletion we erase your personal data (GDPR art. 17) within 30 days at most. We retain the legal minimum (e.g. invoices and fiscal data for 6 years under Spanish General Tax Law art. 66).

Your rights

• Access and portability: export your data as JSON from Settings.
• Rectification: edit your profile or email privacy@remotetalent.dev.
• Erasure ("right to be forgotten"): delete your account from Settings.
• Objection and restriction: write to privacy@remotetalent.dev.
• Consent withdrawal: toggle off any communication option in Settings at any time.
• Complaint to your supervisory authority: if you believe we have violated your rights, you may complain to Spain's Data Protection Agency (AEPD) — aepd.es.

We will respond to requests within 30 days at most (GDPR art. 12.3).

International transfers

When a processor handles data outside the EEA (e.g. servers managed from the United States), they do so under the Standard Contractual Clauses approved by the European Commission (Decision 2021/914) and, where applicable, the EU-US Data Privacy Framework.

Changes

If we update this policy substantially we will notify you by email at least 15 days in advance. Minor changes will be reflected only in the "Last updated" date above.